# Documentation

Everything needed to install packages from composer.meteorgpl.com with Composer 2.

## Add the repository

```sh
composer config repositories.meteorgpl composer https://composer.meteorgpl.com
```

The repository serves Composer 2 metadata only. Every package it carries is listed at https://meteorgpl.com/packages.

## Authenticate

The repository answers only to a token. Create one on your account page (https://meteorgpl.com/account/tokens) and store it in Composer's global auth.json:

```sh
composer config --global http-basic.composer.meteorgpl.com token <your-token>
```

The user name is the literal word `token` (your account e-mail address works as well); the password is the token. Composer writes the pair to `~/.composer/auth.json` (or `$COMPOSER_HOME/auth.json`), never into the project.

In CI, pass the credentials through the environment instead of a file:

```sh
COMPOSER_AUTH='{"http-basic":{"composer.meteorgpl.com":{"username":"token","password":"<your-token>"}}}'
```

Tokens can carry an expiry date and can be revoked at any time from the account page. Repository access is tied to the account: a token of an account without access answers 403 with a pointer to the account page; an unknown, expired or revoked token answers 401.

## Package naming

| Type | Convention | Example |
| --- | --- | --- |
| Plugin | `meteorgpl-plugin/<slug>` | `meteorgpl-plugin/elementor-pro` |
| Theme | `meteorgpl-theme/<slug>` | `meteorgpl-theme/rehub-theme` |

The slug is the plugin's or theme's own folder name under `wp-content/plugins` or `wp-content/themes`, lower-cased. `composer/installers` places the package in a folder of that name, so WordPress sees the directory the vendor ships.

## Example composer.json

### Traditional WordPress

```json
{
    "repositories": [
        { "type": "composer", "url": "https://composer.meteorgpl.com" }
    ],
    "require": {
        "composer/installers": "^2.0",
        "meteorgpl-plugin/elementor-pro": "^3.0",
        "meteorgpl-theme/rehub-theme": "^19.0"
    },
    "extra": {
        "installer-paths": {
            "wp-content/plugins/{$name}/": ["type:wordpress-plugin"],
            "wp-content/themes/{$name}/": ["type:wordpress-theme"]
        }
    },
    "config": {
        "allow-plugins": { "composer/installers": true }
    }
}
```

### Bedrock

Bedrock already requires `composer/installers` and maps both package types to `web/app/plugins` and `web/app/themes`. Add the repository and require the packages; nothing else changes.

## Versions

Every version is a semver tag (`v3.21.0`) in the package's git history, built into a dist zip whose SHA-256 is shown on the package page and in the API. `composer.lock` pins the exact version and the dist checksum, so every environment installs the same bytes.

Every published version stays available. `composer update` moves forward within your constraint; `composer require meteorgpl-plugin/elementor-pro:3.20.0` moves back.

## License keys

Nothing in a package is modified. The vendor's license, activation and update code is shipped as-is. Activate the plugin or theme in WordPress with the key you bought from the vendor; the vendor's own update channel and support remain available to you as the license holder. The licensing page (https://meteorgpl.com/legal/licensing) explains the license profiles shown on each package page and what is stripped from the archives.

## API

A public, read-only JSON API. Responses are cacheable for five minutes (`Cache-Control: public, max-age=300`), limited to 60 requests per minute per IP address; unknown packages answer 404.

- `GET https://meteorgpl.com/api/packages` — the listed packages, 50 per page, newest release first. Parameters: `q` (search), `type` (`plugin` or `theme`), `page`. Each entry: `composer_name, type, title, description, latest_version, latest_released_at, versions_count, license_spdx, license_profile, homepage, url`.
- `GET https://meteorgpl.com/api/packages/{vendor}/{slug}` — one package with its published versions: `version, released_at, dist_size, dist_sha256, requires_php, requires_wp, tested_wp`.
- `GET https://meteorgpl.com/api/stats` — `total_packages, active_plugins, active_themes, total_versions, installs_30d, downloads_30d`. Installs are Composer's notify-batch reports; downloads are dist zip downloads.
- `GET https://meteorgpl.com/api/status` — the promoted repository build: `build_id, created_at, package_count, version_count` (nulls while no build exists).

Every package page is also available as Markdown at `/packages/{vendor}/{slug}.md` or with `Accept: text/markdown`, as is this page at https://meteorgpl.com/docs.md.